Merging internal commits for release/9.0 - #133513
Open
dotnet-bot wants to merge 13 commits into
Open
Conversation
Fix handling of BFinal in WebSocket deflate. [MSRC] [121599] ---- #### AI description (iteration 1) #### PR Classification Bug fix to properly handle WebSocket compressed messages that contain a DEFLATE final block (BFINAL=1 bit set). #### PR Summary Fixes a bug where WebSocket inflater would hang indefinitely when receiving compressed messages terminated with a DEFLATE BFINAL=1 block, which violates the permessage-deflate specification. The inflater now detects and rejects such malformed messages. - `WebSocketInflater.cs`: Added detection logic to check if the DEFLATE stream ended (BFINAL=1) while compressed bytes remain unconsumed, throwing a `WebSocketException` to prevent infinite loops - `WebSocketInflater.cs`: Modified `Inflate` method signature to return `streamEnded` status via an out parameter to track when zlib encounters a final block - `WebSocketDeflateTests.cs`: Added comprehensive test cases covering BFINAL-terminated frames, including both complete and fragmented messages, to verify the fix - `Strings.resx`: Added new error message resource `net_WebSockets_DataAfterBFinal` for the exception thrown when invalid BFINAL termination is detected <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…HttpListenerRequest.Managed The check used to set values > long.MaxValue to 0, allowing the communication to continue even though the real size was quite big. This behavior could lead to Content-Length desynchronization. ---- #### AI description (iteration 1) #### PR Classification Bug fix to reject invalid content length values in HttpListenerRequest.Managed implementation. #### PR Summary This PR fixes the managed HttpListener implementation to strictly reject invalid Content-Length header values (like values exceeding long.MaxValue) instead of treating them as 0, aligning with the Windows parser behavior. - `HttpListenerRequest.Managed.cs`: Changed Content-Length parsing to use strict `long.TryParse` with `NumberStyles.None` to reject values outside valid range instead of converting oversized values to 0 - `InvalidClientRequestTests.cs`: Added new test cases to verify that oversized Content-Length values (long.MaxValue+1 and ulong.MaxValue) result in "Bad Request" errors - `HttpListenerRequestTests.cs`: Removed test cases that previously expected oversized Content-Length values to be accepted and treated as 0 <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Update MsQuic to the privately built MsQuic 2.5.9 ---- #### AI description (iteration 1) #### PR Classification Dependency update to upgrade the MsQuic native library version for QUIC protocol support. #### PR Summary This pull request updates the MsQuic Schannel dependency from version 2.4.18 to 2.5.9-ci.151956570 in the release/9.0 branch. - `eng/Versions.props`: Updated `MicrosoftNativeQuicMsQuicSchannelVersion` package version from 2.4.18 to 2.5.9-ci.151956570 <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
#### AI description (iteration 1) #### PR Classification Dependency version update and bug fix for tar file symlink extraction safety checks. #### PR Summary Updates multiple test data package dependencies from version 9.0.0-beta.26302.4 to 9.0.0-beta.26330.2 and fixes a critical security issue in tar file extraction logic for symlink validation. - `System.Formats.Tar`: Fixed symlink traversal vulnerability by correcting path validation logic to properly handle cases where the file resolves to the destination directory itself, and improved symlink resolution to handle dangling symlinks - `TarFile.ExtractToDirectory.Stream.Tests.cs` and `TarFile.ExtractToDirectoryAsync.Stream.Tests.cs`: Removed `[ActiveIssue]` attributes from symlink and hardlink extraction tests - `Version.Details.xml` and `Versions.props`: Updated runtime-assets test data dependencies, XHarness packages, and Cecil packages to newer versions - `SveScatterVectorBases.template` and `SveGatherVectorFirstFaultingVectorBases.template`: Enhanced pointer validation logic with additional debug assertions <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…_name. #### AI description (iteration 1) #### PR Classification Bug fix to properly handle truncation errors when generating default IPC transport names. #### PR Summary This PR fixes error handling in the IPC transport name generation code to prevent silent failures when socket paths are truncated or invalid. The changes ensure that failures in `PAL_GetTransportName` are properly detected and propagated, and that empty socket paths (which would incorrectly bind to Linux abstract namespace) are rejected. - `ds-ipc-pal-socket.c`: Added proper error handling with `ep_raise_error_if_nok` macros for socket name generation, validation to reject empty `sun_path`, and cleanup logic to free allocated memory on error - `ds-ipc-pal-socket.c` and `ds-rt-coreclr.h`: Modified `ipc_transport_get_default_name` and `ds_rt_transport_get_default_name` to return `false` when name generation fails (detected by empty string) <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> ---- #### AI description (iteration 1) #### PR Classification Bug fix to properly handle truncation errors when generating default IPC transport names in EventPipe socket operations. #### PR Summary This PR adds proper error handling for socket path truncation in the IPC transport layer, ensuring that failed name generation is detected and handled gracefully rather than silently creating invalid socket paths. - `/src/native/eventpipe/ds-ipc-pal-socket.c`: Added error checking for `ipc_transport_get_default_name` return value, validation that `sun_path` is not empty to prevent binding to Linux abstract namespace, and proper error cleanup with memory deallocation - `/src/native/eventpipe/ds-ipc-pal-socket.c` and `/src/coreclr/vm/eventing/eventpipe/ds-rt-coreclr.h`: Changed `ipc_transport_get_default_name` and `ds_rt_transport_get_default_name` to return `false` when name generation fails (indicated by empty string)
….26405.2 Update Microsoft.DiaSymReader.Native to 18.9.0-beta1.26405.2 ---- #### AI description (iteration 1) #### PR Classification Dependency update to upgrade the Microsoft.DiaSymReader.Native package version. #### PR Summary This pull request updates the Microsoft.DiaSymReader.Native dependency from version 17.12.0-beta1.24603.5 to 18.9.0-beta1.26405.2. - `eng/Versions.props`: Updated `MicrosoftDiaSymReaderNativeVersion` property to reference the newer beta version 18.9.0-beta1.26405.2 <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
merge from public
…-merge-9.0-2026-09-09-1723
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
This was referenced Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.